@crvouga/dev-fleet 0.1.0 → 0.3.0

package/src/ide/definition.ts

@@ -0,0 +1,86 @@
+import { FleetUsageError } from '../errors';
+import { record } from '../config';
+
+/** The IDEs dev-fleet supports. The support matrix in the README lists the
+ * same; enabling one on the fleet is `ides` in fleet.json, not new code.
+ */
+export const SUPPORTED_IDES = ['t3'] as const;
+export type IdeId = (typeof SUPPORTED_IDES)[number];
+
+/** What `t3` in fleet.json declares for every machine's T3. */
+export interface T3Definition {
+  /** Top-level T3 settings every machine holds the same: tool servers,
+   * projects, selected preferences. A key not named here stays local.
+   */
+  profile?: Record<string, unknown>;
+  /** Models T3 must offer for every account of a tool, by tool. */
+  requiredModels?: Record<string, string[]>;
+}
+
+const KEY = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/;
+/** Settings another part of dev-fleet owns. */
+const RESERVED = ['providerInstances'];
+
+function invalid(detail: string): never {
+  throw new FleetUsageError(`Invalid fleet.json: ${detail}`);
+}
+
+/** The IDEs a fleet runs: those it names, or T3 alone. */
+export const idesOf = (definition: { ides?: readonly IdeId[] }): IdeId[] => [
+  ...(definition.ides ?? ['t3']),
+];
+
+export function parseIdes(value: unknown): IdeId[] {
+  if (
+    !Array.isArray(value) ||
+    value.length === 0 ||
+    new Set(value).size !== value.length ||
+    value.some((id) => !SUPPORTED_IDES.includes(id as IdeId))
+  )
+    invalid(`ides lists each of ${SUPPORTED_IDES.join(', ')} at most once.`);
+  return value as IdeId[];
+}
+
+export function parseT3(value: unknown): T3Definition {
+  if (
+    !record(value) ||
+    Object.keys(value).some(
+      (key) => !['profile', 'requiredModels'].includes(key)
+    )
+  )
+    invalid('t3 holds only profile and requiredModels.');
+  const result: T3Definition = {};
+  if (value['profile'] !== undefined) {
+    const profile = value['profile'];
+    if (
+      !record(profile) ||
+      Object.keys(profile).some(
+        (key) => !KEY.test(key) || RESERVED.includes(key)
+      ) ||
+      JSON.stringify(profile).length > 65_536
+    )
+      invalid(
+        't3.profile names top-level T3 settings (not providerInstances) and stays under 64 KiB.'
+      );
+    result.profile = profile;
+  }
+  if (value['requiredModels'] !== undefined) {
+    const required = value['requiredModels'];
+    if (
+      !record(required) ||
+      Object.entries(required).some(
+        ([tool, models]) =>
+          !KEY.test(tool) ||
+          !Array.isArray(models) ||
+          models.some(
+            (model) =>
+              typeof model !== 'string' ||
+              !/^[A-Za-z0-9._:-]{1,128}$/.test(model)
+          )
+      )
+    )
+      invalid('t3.requiredModels lists model names by tool.');
+    result.requiredModels = required as Record<string, string[]>;
+  }
+  return result;
+}

package/src/ide/ide.ts

@@ -0,0 +1,43 @@
+import type { Check, FleetNode, Runner } from '../types';
+
+/** What every supported IDE is asked for. An implementation owns its own
+ * install, service and policy (an Ansible role per IDE, with the common
+ * variable contract: version, checksum, policy, instances, profile) and is
+ * reached only through these calls, so the orchestration never names one.
+ */
+export interface Ide {
+  /** The name the fleet configuration enables it by, under `ides`. */
+  readonly id: string;
+  /** The IDE's settings on this machine: provider instances from the account
+   * roster, the declared profile and the models it offers. Run on the manager
+   * and on every worker by the machine itself.
+   */
+  settings(context: MachineContext): Promise<Check[]>;
+  /** The manager's own IDE: its settings, its pinned version and its policy. */
+  manager(context: MachineContext): Promise<Check[]>;
+  /** What the manager measures of a worker's IDE: remote access, pairing and
+   * the version the worker runs.
+   */
+  worker(node: FleetNode, context: WorkerContext): Promise<Check[]>;
+}
+
+export interface MachineContext {
+  /** The node ID this machine is in the fleet. */
+  id: string;
+  /** The checkout this run applies. */
+  workspace: string;
+  apply: boolean;
+  run: Runner;
+}
+
+export interface WorkerContext {
+  run: Runner;
+  /** The manager's checkout of the revision this sync applies. */
+  workspace: string;
+  /** The checks this sync already reported for the worker. */
+  earlier: Check[];
+  /** Records what identifies the worker's IDE in the fleet state, the first
+   * time it is seen through a verified link.
+   */
+  remember?: (node: string, identity: string) => Promise<void>;
+}

package/src/ide/index.ts

@@ -0,0 +1,5 @@
+import type { Ide } from './ide';
+import { t3Ide } from './t3';
+
+/** Every IDE dev-fleet implements, by the ID fleet.json enables it with. */
+export const IDES: Readonly<Record<string, Ide>> = { t3: t3Ide() };

package/src/ide/orchestrate.ts

@@ -0,0 +1,50 @@
+import type { Check, FleetNode } from '../types';
+import type { Ide, MachineContext, WorkerContext } from './ide';
+
+/** The implementations the fleet enables, in the order it names them. An ID
+ * nobody implements is refused before anything runs.
+ */
+export function enabled(
+  ids: readonly string[],
+  registry: Readonly<Record<string, Ide>>
+): Ide[] {
+  return ids.map((id) => {
+    const ide = registry[id];
+    if (!ide) throw new Error(`Unsupported IDE: ${id}`);
+    return ide;
+  });
+}
+
+export async function settingsChecks(
+  ides: Ide[],
+  context: MachineContext
+): Promise<Check[]> {
+  const checks: Check[] = [];
+  for (const ide of ides) checks.push(...(await ide.settings(context)));
+  return checks;
+}
+
+export async function managerChecks(
+  ides: Ide[],
+  context: MachineContext
+): Promise<Check[]> {
+  const checks: Check[] = [];
+  for (const ide of ides) checks.push(...(await ide.manager(context)));
+  return checks;
+}
+
+export async function workerChecks(
+  ides: Ide[],
+  node: FleetNode,
+  context: WorkerContext
+): Promise<Check[]> {
+  const checks: Check[] = [];
+  for (const ide of ides)
+    checks.push(
+      ...(await ide.worker(node, {
+        ...context,
+        earlier: [...context.earlier, ...checks],
+      }))
+    );
+  return checks;
+}

package/src/ide/t3.ts

@@ -0,0 +1,111 @@
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import type { Check, FleetNode } from '../types';
+import type { Ide, MachineContext, WorkerContext } from './ide';
+import { fleet } from '../fleet-config';
+import { machineProviders } from '../t3/providers';
+import { providerNames } from '../t3/names-check';
+import { profileCheck } from '../t3/profile';
+import { modelsCheck } from '../t3/models';
+import { proxyAccounts, type Roster } from '../t3/accounts';
+import {
+  MACOS_POLICY,
+  managerVersion,
+  updatesCheck,
+  workerVersion,
+} from '../t3/version';
+import { verifyT3Endpoint } from '../t3-endpoint';
+import { observedIdentity, verifyT3Linked } from '../t3-linked-check';
+import { T3_RESTARTED_SUMMARY } from '../platform/t3-policy';
+import { ansibleCommand } from '../platform/ansible';
+
+/** Where T3 keeps its data on this machine. */
+const t3Home = (): string =>
+  resolve(process.env['T3CODE_HOME'] ?? join(homedir(), '.t3'));
+
+/** What the T3 checks read besides the machine: injected by scenarios. */
+export interface T3Inputs {
+  t3Home?: string;
+  roster?: Roster;
+  profile?: Record<string, unknown>;
+  requiredModels?: Record<string, string[]>;
+  policyPath?: string;
+}
+
+/** T3 Code, the first supported IDE. Its install, service and policy on
+ * workers are the `ansible/ubuntu/t3*` playbooks and on the manager
+ * `ansible/macos/t3-policy.yml`; everything else is reached from here.
+ */
+export function t3Ide(inputs: T3Inputs = {}): Ide {
+  const home = () => inputs.t3Home ?? t3Home();
+  const settings = async (context: MachineContext): Promise<Check[]> => {
+    const required = inputs.requiredModels ?? fleet.t3?.requiredModels;
+    const options = {
+      t3Home: home(),
+      ...(inputs.roster ? { roster: inputs.roster } : {}),
+    };
+    return [
+      await machineProviders(
+        context.id,
+        context.workspace,
+        context.apply,
+        options
+      ),
+      await providerNames(
+        context.id,
+        context.workspace,
+        context.apply,
+        options
+      ),
+      await profileCheck(
+        join(home(), 'userdata/settings.json'),
+        inputs.profile ?? fleet.t3?.profile ?? {},
+        { apply: context.apply }
+      ),
+      await modelsCheck({
+        t3Home: home(),
+        roster: inputs.roster ?? proxyAccounts,
+        ...(required ? { required } : {}),
+      }),
+    ];
+  };
+  return {
+    id: 't3',
+    settings,
+    async manager(context) {
+      return [
+        ...(await settings(context)),
+        await managerVersion(home(), context.workspace),
+        await updatesCheck(
+          inputs.policyPath ?? MACOS_POLICY,
+          `cd ${context.workspace} && ${ansibleCommand().join(' ')} -K ansible/macos/manager.yml`
+        ),
+      ];
+    },
+    async worker(node: FleetNode, context: WorkerContext) {
+      const checks = [...(await verifyT3Endpoint(node, context.run))];
+      // A worker T3 restarted by this sync (idle policy heal) needs a minute
+      // or two before the manager's link reconnects.
+      const restarted = context.earlier.some(
+        (check) => check.summary === T3_RESTARTED_SUMMARY
+      );
+      const linked = await verifyT3Linked(node, context.run, {
+        reconnectMs: restarted ? 180_000 : 0,
+      });
+      checks.push(linked);
+      if (
+        linked.status !== 'fail' &&
+        !node.t3EnvironmentId &&
+        context.remember
+      ) {
+        const identity = await observedIdentity(node, context.run).catch(
+          () => undefined
+        );
+        if (identity)
+          await context.remember(node.id, identity).catch(() => undefined);
+      }
+      checks.push(await workerVersion(node, context.run, context.workspace));
+      return checks;
+    },
+  };
+}

package/src/machine/source.ts

@@ -5,7 +5,7 @@ import type { Runner } from '../types';
 import { ensurePrivateRoot } from './state';
 import { fleet } from '../fleet-config';
 
-const REPOSITORY = fleet.source.repository;
+const repository = (): string => fleet.source.repository;
 
 /** Called after approval; local sources supply Git objects only, never dirty files. */
 export async function prepareSource(
@@ -40,7 +40,7 @@ async function prepareRemoteSource(
         '--no-checkout',
         '--origin',
         'origin',
-        REPOSITORY,
+        repository(),
         source,
       ],
       { timeoutMs: 120_000 }
@@ -48,7 +48,7 @@ async function prepareRemoteSource(
     if (!cloned.ok) return null;
     origin = await run(['git', 'remote', 'get-url', 'origin'], { cwd: source });
   }
-  if (!origin.ok || origin.stdout.trim() !== REPOSITORY) return null;
+  if (!origin.ok || origin.stdout.trim() !== repository()) return null;
   let found = await run(
     ['git', 'rev-parse', '--verify', `${revision}^{commit}`],
     { cwd: source }

package/src/machine/state.ts

@@ -25,14 +25,19 @@ export interface Enrollment {
 export const isRevision = (value: unknown): value is string =>
   typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
 
+/** The manager's enrollment from the file that held it before it moved into
+ * the fleet state (src/state/enrollment.ts). Nothing writes this file now.
+ */
 export async function readEnrollment(root: string): Promise<Enrollment | null> {
   try {
     const path = join(root, 'enrollment.json');
     const info = await lstat(path);
     if (!info.isFile() || info.size > 4096) throw new Error();
-    const data: unknown = JSON.parse(await readFile(path, 'utf8'));
-    if (!validEnrollment(data)) throw new Error();
-    return data as unknown as Enrollment;
+    const enrollment = parseEnrollment(
+      JSON.parse(await readFile(path, 'utf8'))
+    );
+    if (!enrollment) throw new Error();
+    return enrollment;
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
     throw new FleetUsageError(
@@ -41,24 +46,6 @@ export async function readEnrollment(root: string): Promise<Enrollment | null> {
   }
 }
 
-export async function saveEnrollment(
-  root: string,
-  state: Enrollment
-): Promise<void> {
-  await mkdir(root, { recursive: true, mode: 0o700 });
-  const path = join(root, 'enrollment.json');
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
-    await writeFile(temporary, JSON.stringify(state) + '\n', {
-      mode: 0o600,
-      flag: 'wx',
-    });
-    await rename(temporary, path);
-  } finally {
-    await rm(temporary, { force: true });
-  }
-}
-
 /** A lock directory with no readable owner is only abandoned after this long,
  * so a run that has just created it but not yet written `owner.json` is safe. */
 const OWNERLESS_LOCK_GRACE_MS = 60_000;
@@ -169,17 +156,18 @@ export async function ensurePrivateRoot(root: string): Promise<void> {
   }
 }
 
-function validEnrollment(data: unknown): boolean {
-  if (!record(data) || data['version'] !== 1) return false;
+/** A valid enrollment record, or null. */
+export function parseEnrollment(data: unknown): Enrollment | null {
+  if (!record(data) || data['version'] !== 1) return null;
   if (
     typeof data['id'] !== 'string' ||
     !/^[a-z][a-z0-9-]{0,62}$/.test(data['id'])
   )
-    return false;
-  return (
-    isRevision(data['approvedRevision']) &&
+    return null;
+  return isRevision(data['approvedRevision']) &&
     ['appliedRevision', 'previousRevision'].every(
       (key) => data[key] === undefined || isRevision(data[key])
     )
-  );
+    ? (data as unknown as Enrollment)
+    : null;
 }

package/src/manager-sync.ts

@@ -10,7 +10,7 @@ import { discoverTailnet, type TailnetComputer } from './tailscale';
 import { matchComputers } from './tailnet-matching';
 import { sshArgs, sshFailure } from './ssh';
 import type { FleetDefinition, MachineDefinition } from './definition';
-import { PUBLIC_HUB_URL } from './monitoring/beszel';
+import { publicHubUrl } from './monitoring/beszel';
 import {
   convergeable,
   evaluatePlatform,
@@ -104,7 +104,7 @@ export async function synchronizeManager(
     desiredRevision: input.revision,
     checks: tailnet.checks,
     // Printed for people: the stable public name, never a tailnet address.
-    dashboardUrl: PUBLIC_HUB_URL,
+    dashboardUrl: publicHubUrl(),
     nodes: [],
     candidates: tailnet.computers.filter(
       (peer) => !peer.self && !matches.get(peer.id)?.length
@@ -179,7 +179,12 @@ async function applyNodes(
   deploy: DeployNode
 ): Promise<void> {
   const workers = report.nodes.filter((node) => node.role !== 'manager');
-  const canary = workers.find((node) => node.node === input.canary);
+  // A revision new to the fleet is proven on one worker first. When the run
+  // selects only later workers, the first selected one proves it instead:
+  // narrowing a run never skips the canary.
+  const canary = input.canary
+    ? (workers.find((node) => node.node === input.canary) ?? workers[0])
+    : undefined;
   let blocked = report.checks.some(blocking);
   const step = async (result: ManagerNode) => {
     const deployable = mayDeploy(result, input.nodes);
@@ -380,21 +385,7 @@ function mayDeploy(result: ManagerNode, nodes: FleetNode[]): boolean {
  */
 export function blocksPromotion(check: Check): boolean {
   if (!blocking(check)) return false;
-  if (check.id === 't3:service' && T3_MAINTENANCE.has(check.summary))
-    return false;
-  return !/^(worker:|beszel:|provider:|agent:|proxy:|t3:end-to-end$|t3:paired-access$|t3:policy-loaded$|ubuntu:boot-policy$)/.test(
+  return !/^(worker:|beszel:|provider:|agent:|proxy:|t3:end-to-end$|t3:paired-access$|t3:policy-loaded$|t3:running-version$|ubuntu:boot-policy$)/.test(
     check.id
   );
 }
-
-/** Native T3 outcomes that need an operator maintenance window (an active
- * listener or running release must never be killed by routine sync). They are
- * reported as failures but do not block independent OS policy on other nodes.
- */
-const T3_MAINTENANCE = new Set([
-  'T3_LISTENER_CONFLICT',
-  'T3_ACTIVE_LISTENER_MIGRATION_REQUIRED',
-  'T3_MAINTENANCE_REQUIRED',
-  'T3_POLICY_RESTART_PENDING',
-  'T3_DESKTOP_MIGRATION_REQUIRED',
-]);

package/src/monitoring/agent-evidence.ts

@@ -0,0 +1,146 @@
+import type { Check, Runner } from '../types';
+
+/** Where installing the agent writes: the pinned build and its state. */
+export const AGENT_PATHS = ['/usr/local/lib', '/var/lib'] as const;
+/** Room for the archive, the extracted build and the agent's state. */
+export const AGENT_FREE_KIB = 256 * 1024;
+
+/** Measures, before anything is installed, that each path the agent writes
+ * to has room. A full disk is named as such instead of surfacing later as an
+ * incomplete installation.
+ */
+export async function agentDisk(run: Runner): Promise<Check> {
+  const result = await run(['df', '-Pk', ...AGENT_PATHS], {
+    timeoutMs: 10_000,
+  });
+  const free = result.ok ? available(result.stdout) : null;
+  if (!free || free.length !== AGENT_PATHS.length)
+    return {
+      id: 'beszel:disk',
+      status: 'fail',
+      summary: 'BESZEL_DISK_UNVERIFIED',
+      remedy: {
+        action: `Free space under ${AGENT_PATHS.join(' and ')} could not be measured. Check that df works for the fleet user, then rerun fleet-sync. Nothing was installed.`,
+      },
+    };
+  const least = Math.min(...free);
+  if (least < AGENT_FREE_KIB)
+    return {
+      id: 'beszel:disk',
+      status: 'fail',
+      summary: 'BESZEL_DISK_FULL',
+      remedy: {
+        action: `The monitoring agent needs ${AGENT_FREE_KIB / 1024} MiB free under each of ${AGENT_PATHS.join(' and ')}; the fullest has ${Math.floor(least / 1024)} MiB. Free space on the worker, then rerun fleet-sync. Nothing was installed and the running agent was left as it was.`,
+      },
+    };
+  return {
+    id: 'beszel:disk',
+    status: 'pass',
+    summary: `At least ${Math.floor(least / 1024)} MiB free where the agent is installed.`,
+  };
+}
+
+/** The "Available" column of POSIX df output, one value per path. */
+function available(output: string): number[] | null {
+  const rows = output.trim().split('\n').slice(1);
+  const values = rows.map((row) => Number(row.trim().split(/\s+/)[3]));
+  return values.length && values.every(Number.isSafeInteger) ? values : null;
+}
+
+/** What the pinned agent (Beszel 0.21.1) logs about its connection to the
+ * hub, from its source:
+ * - `agent/connection_manager.go` logs "WebSocket connected" once the hub
+ *   proved its key;
+ * - the hub answers an unknown token with 401 (`internal/hub/agent_connect.go`),
+ *   which the WebSocket library reports as "unexpected status code: 401";
+ * - a hub whose key is not the one the agent was given fails
+ *   `verifySignature`: "invalid signature - check KEY value";
+ * - a hub that is down behind its private route answers 502, 503 or 504.
+ * Only these fixed texts are matched; nothing of the log is reported.
+ */
+const OUTCOMES: { pattern: RegExp; check: Omit<Check, 'id'> }[] = [
+  {
+    pattern: /WebSocket connected/,
+    check: {
+      status: 'pass',
+      summary: 'The agent is connected to the hub, which proved its key.',
+    },
+  },
+  {
+    pattern: /unexpected status code: 401\b/,
+    check: {
+      status: 'fail',
+      summary: 'BESZEL_AGENT_TOKEN_REJECTED',
+      remedy: {
+        action:
+          "The hub refused this worker's agent token. Rerun fleet-sync from the manager so the worker's enrollment is resumed and its token delivered again. Never register a second record for the worker.",
+      },
+    },
+  },
+  {
+    pattern: /invalid signature - check KEY value/,
+    check: {
+      status: 'fail',
+      summary: 'BESZEL_AGENT_KEY_REJECTED',
+      remedy: {
+        action:
+          "The hub the agent reached did not prove the key it was given. Make sure the worker's agent points at the manager's hub, then rerun fleet-sync from the manager so the hub's key is delivered again.",
+      },
+    },
+  },
+  {
+    pattern: /unexpected status code: 50[234]\b/,
+    check: {
+      status: 'warn',
+      summary: 'BESZEL_HUB_UNAVAILABLE_TO_AGENT',
+      remedy: {
+        action:
+          'The private route answered but the hub behind it did not. Keep the manager awake with Docker Desktop running and rerun fleet-sync there; the agent reconnects by itself.',
+      },
+    },
+  },
+];
+
+/** The agent's newest connection outcome, read from its own log. The log
+ * holds host names, so only the outcome is reported.
+ */
+export async function agentConnection(run: Runner): Promise<Check> {
+  const result = await run(
+    [
+      'sudo',
+      '-n',
+      'journalctl',
+      '--unit=beszel-agent.service',
+      '--output=cat',
+      '--no-pager',
+      '--lines=200',
+    ],
+    { timeoutMs: 10_000 }
+  );
+  if (!result.ok)
+    return {
+      id: 'beszel:hub-connection',
+      status: 'skip',
+      summary: 'BESZEL_AGENT_LOG_UNAVAILABLE',
+      remedy: {
+        action:
+          "The agent's log could not be read, so how the hub answered it is unknown. The hub's own evidence in fleet-status --workers still applies.",
+      },
+    };
+  return { id: 'beszel:hub-connection', ...newestOutcome(result.stdout) };
+}
+
+function newestOutcome(log: string): Omit<Check, 'id'> {
+  const lines = log.split('\n').reverse();
+  for (const line of lines)
+    for (const outcome of OUTCOMES)
+      if (outcome.pattern.test(line)) return outcome.check;
+  return {
+    status: 'skip',
+    summary: 'BESZEL_AGENT_CONNECTION_PENDING',
+    remedy: {
+      action:
+        'The agent has not reached the hub yet. The next fleet-sync, or fleet-status --workers, reports whether it did.',
+    },
+  };
+}

package/src/monitoring/apply.ts

@@ -6,13 +6,15 @@ import { hubUrl, roleOf } from '../topology';
 import { record } from '../config';
 import { isRevision } from '../machine/state';
 import { privateHub } from './beszel';
+import { agentConnection, agentDisk } from './agent-evidence';
 import { runLockedCommand as runCommand } from '../runner';
 import type { Check, Runner } from '../types';
 
 export async function applyAgent(
   value: unknown,
   root: string,
-  run: Runner
+  run: Runner,
+  options: { receipts?: string } = {}
 ): Promise<Check[]> {
   const request = validateRequest(value);
   const definition = fleet;
@@ -32,7 +34,7 @@ export async function applyAgent(
   // Agents connect only to the manager's private hub URL.
   if (privateHub(request.hubUrl) !== privateHub(hubUrl(definition)))
     throw new Error('BESZEL_HUB_MISMATCH');
-  return installAgent(request, root, run);
+  return installAgent(request, root, run, options.receipts);
 }
 
 /** Workers (Linux) install a hardened systemd unit. The macOS manager's own
@@ -42,8 +44,12 @@ export async function applyAgent(
 async function installAgent(
   request: Request,
   root: string,
-  run: Runner
+  run: Runner,
+  receipts: string | undefined
 ): Promise<Check[]> {
+  // Measured before anything changes: a full disk is named, not guessed at.
+  const disk = await agentDisk(run);
+  if (disk.status !== 'pass') return [disk];
   const monitoring = resolve(root, 'ansible/monitoring');
   const result = await runAnsibleWithReceipt(
     run,
@@ -62,10 +68,12 @@ async function installAgent(
       name: 'beszel-agent',
       sources: [monitoring],
       verify: () => agentActive(run),
+      ...(receipts ? { directory: receipts } : {}),
     }
   );
   if (!result.ok)
     return [
+      disk,
       {
         id: 'beszel:installation',
         status: 'fail',
@@ -78,6 +86,7 @@ async function installAgent(
     ];
   const ready = await agentActive(run);
   return [
+    disk,
     {
       id: 'beszel:service',
       status: ready ? 'pass' : 'fail',
@@ -85,6 +94,9 @@ async function installAgent(
         ? 'Native Beszel service is enabled and active; hub metrics remain a separate gate.'
         : 'BESZEL_SERVICE_STOPPED',
     },
+    // How the hub answered the agent, from the agent's side: a rejected token
+    // or key is told apart from a hub that is merely down.
+    ...(ready ? [await agentConnection(run)] : []),
   ];
 }
 async function agentActive(run: Runner): Promise<boolean> {